1. Field of the Invention
This invention relates generally to secure communications. More particularly it relates to authentication of a network device.
2. Background of the Related Art
Conventional service and network administration systems control external access to services with an authentication, access control, or gateway device at the edge of an internal network, such that the gateway device resides between the servers that provide a given service, and the clients that utilize that service. As used herein, the term “server” refers generally to one or more computer systems that work individually or cooperatively to provide a service to client devices.
FIG. 7 shows conventional authentication wherein network-level traffic management policy requires inbound traffic to be forced to pass through a gateway device.
In particular, as shown in FIG. 7, an authenticating gateway 700 resides in a given internal network 702, providing a forced bottleneck between one or more clients 704 and one or more services 710, 712. All external network traffic must pass through the authenticating gateway 700. The authenticating gateway 700 enforces security policy.
By forcing all traffic through the authenticating gateway 700, all security functions are performed by the authenticating gateway 700 (such as authentication, access control, and admission control). Doing so has a great advantage in that these functions do not then have to be included as part of the services 710, 712. Rather, only the authenticating gateway device 700 need be accounted for as part of the overall service architecture.
A core observation by the present inventors is that servers in the cloud are typically geographically or topographically decentralized. As a result, the use of an inline gateway device for security has several significant flaws for modern services in a cloud environment: (1) Lack of Scalability. All traffic to and from a service's servers must be routed through the gateway device, to ensure that the gateway device provides its security function. (2) Server co-location. Servers must be placed close (spatially and/or topographically) to the gateway device, for the gateway-to-server link not to add significant latency to service response times. (3) Inflexible Architecture. Clients must communicate with the gateway device, not with the actual servers.
Cloud computing addresses these flaws by allowing servers (and therefore services) to run with spatial and computational independence. Unfortunately, in doing so the ability to control the flow of traffic between a client and a server is lost; in particular network-level traffic routing rules can no longer be used to achieve the desired security architecture.